According to BleepingComputer, Carnival began notifying 5,995,277 people that attackers used social engineering in April to deceive an employee, accessed part of its IT systems and stole personal data, which the company confirmed was copied on April 22 [1]. According to SecurityWeek, the data varies by person but generally includes names, addresses, birth dates, emails, phone numbers and government ID numbers; ShinyHunters claimed the breach in April [2][1]. Notified people can enroll in the 24 months of free credit monitoring Carnival offers [2].
This event has not been officially confirmed. Content is based on media or third-party reports.
Backfill: this event became public on May 27, 2026 and we added it on Nov 11, 2026. It is not a new event.
HighResolvedBackfillMedia reported
Cruise operator Carnival breached after employee falls for social engineering; ID numbers of nearly 6 million stolen
1 min read
- Disclosed
- May 27, 2026
- Occurred
- Apr 10, 2026
- Published
- Nov 11, 2026
- Last updated
- Nov 11, 2026
- Scale
- 5,995,277 people[2]
- CVSS basis
- Our assessment
- Attack vector
- Impact
- Data type
- Actor type
- Motivation
On this page
30-second summary
Timeline
Technical details
Remediation
Vendor guidance
- 1Enroll in credit monitoring mitigate[2]
Enroll in the 24 months of free credit monitoring.
References
Media2
- [1]BleepingComputer2026-05-28Accessed 2026-11-11Snapshot 2026-11-11 sha256 48ca4d8000b1
“The company started notifying 5,995,277 customers on Wednesday that threat actors stole their data in an April 10 breach after gaining access to some of its IT systems in a social engineering attack.”
- [2]SecurityWeek
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.